Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

bifs/parse_eftp: Prevent reporter warnings/errors on invalid input

Browse source 
When passing invalid IPs or an out-of range port to parse_eftp()
a warning or error was generated on stderr (in addition to setting
the $valid field to F). Prevent the output by adding safe-guarding
and using IPAddr::ConvertString() instead.
This commit is contained in:
Arne Welzel 2023-01-16 15:16:29 +01:00
parent d4a84e7442
commit eb09662d48
3 changed files with 21 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/analyzer/protocol/ftp/functions.bif
View file

@ -87,12 +87,10 @@ static zeek::ValPtr parse_eftp(const char* line)
}
std::string s(line, nptr-line); // extract IP address
zeek::IPAddr tmp(s);
// on error, "tmp" will have all 128 bits zero
if ( tmp == addr )
good = 0;
addr = tmp;
struct in6_addr result;
good = zeek::IPAddr::ConvertString(s.c_str(), &result) ? 1 : 0;
if ( good )
addr = zeek::IPAddr(result);
}
line = strchr(line, delimiter);
@ -103,8 +101,13 @@ static zeek::ValPtr parse_eftp(const char* line)
port = strtol(line, &next_delim, 10);
if ( *next_delim != delimiter )
good = 0;
}
if ( port < 0 || port > 65535 )
{
port = 0;
good = 0;
}
}
}
}